A novel security risk evaluation for information systems

Zaobin Gan; Jiufei Tang; Ping Wu; Vijay Varadharajan

doi:10.1109/FCST.2007.9

A novel security risk evaluation for information systems

Zaobin Gan^*, Jiufei Tang, Ping Wu, Vijay Varadharajan

^*Corresponding author for this work

School of Computing

Research output: Chapter in Book/Report/Conference proceeding › Conference proceeding contribution › peer-review

3 Citations (Scopus)

Abstract

Quantitative security risk evaluation of information systems is increasingly drawing more and more attention. This paper extends the attack tree model, and proposes a new quantitative risk evaluation method .While the risk value of the leaf node (atomic attack) is quantified, the multiattribute utility theory is adopted. All algorithms are presented for each steps of this new evaluation method. In addition, a worked example is also experimented in this paper. The experimental result shows that the novel method can not only make the evaluation result more reasonable and objective, but also offer a good foundation for the implementation of the automatic evaluation tool.

Original language	English
Title of host publication	Proceedings - 2007 Japan-China Joint Workshop on Frontier of Computer Science and Technology, FCST 2007
Place of Publication	Los Alamitos, Calif
Publisher	Institute of Electrical and Electronics Engineers (IEEE)
Pages	67-73
Number of pages	7
ISBN (Print)	0769530362, 9780769530369
DOIs	https://doi.org/10.1109/FCST.2007.9
Publication status	Published - 2007
Event	2007 Japan-China Joint Workshop on Frontier of Computer Science and Technology, FCST 2007 - Wuhan, China Duration: 1 Nov 2007 → 3 Nov 2007

Other

Other	2007 Japan-China Joint Workshop on Frontier of Computer Science and Technology, FCST 2007
Country/Territory	China
City	Wuhan
Period	1/11/07 → 3/11/07

Access to Document

10.1109/FCST.2007.9

Cite this

@inproceedings{184eada1cb21491088faed24652aa75f,

title = "A novel security risk evaluation for information systems",

abstract = "Quantitative security risk evaluation of information systems is increasingly drawing more and more attention. This paper extends the attack tree model, and proposes a new quantitative risk evaluation method .While the risk value of the leaf node (atomic attack) is quantified, the multiattribute utility theory is adopted. All algorithms are presented for each steps of this new evaluation method. In addition, a worked example is also experimented in this paper. The experimental result shows that the novel method can not only make the evaluation result more reasonable and objective, but also offer a good foundation for the implementation of the automatic evaluation tool.",

author = "Zaobin Gan and Jiufei Tang and Ping Wu and Vijay Varadharajan",

year = "2007",

doi = "10.1109/FCST.2007.9",

language = "English",

isbn = "0769530362",

pages = "67--73",

booktitle = "Proceedings - 2007 Japan-China Joint Workshop on Frontier of Computer Science and Technology, FCST 2007",

publisher = "Institute of Electrical and Electronics Engineers (IEEE)",

address = "United States",

note = "2007 Japan-China Joint Workshop on Frontier of Computer Science and Technology, FCST 2007 ; Conference date: 01-11-2007 Through 03-11-2007",

}

Gan, Z, Tang, J, Wu, P & Varadharajan, V 2007, A novel security risk evaluation for information systems. in Proceedings - 2007 Japan-China Joint Workshop on Frontier of Computer Science and Technology, FCST 2007., 4402602, Institute of Electrical and Electronics Engineers (IEEE), Los Alamitos, Calif, pp. 67-73, 2007 Japan-China Joint Workshop on Frontier of Computer Science and Technology, FCST 2007, Wuhan, China, 1/11/07. https://doi.org/10.1109/FCST.2007.9

A novel security risk evaluation for information systems. / Gan, Zaobin; Tang, Jiufei; Wu, Ping et al.
Proceedings - 2007 Japan-China Joint Workshop on Frontier of Computer Science and Technology, FCST 2007. Los Alamitos, Calif: Institute of Electrical and Electronics Engineers (IEEE), 2007. p. 67-73 4402602.

Research output: Chapter in Book/Report/Conference proceeding › Conference proceeding contribution › peer-review

TY - GEN

T1 - A novel security risk evaluation for information systems

AU - Gan, Zaobin

AU - Tang, Jiufei

AU - Wu, Ping

AU - Varadharajan, Vijay

PY - 2007

Y1 - 2007

N2 - Quantitative security risk evaluation of information systems is increasingly drawing more and more attention. This paper extends the attack tree model, and proposes a new quantitative risk evaluation method .While the risk value of the leaf node (atomic attack) is quantified, the multiattribute utility theory is adopted. All algorithms are presented for each steps of this new evaluation method. In addition, a worked example is also experimented in this paper. The experimental result shows that the novel method can not only make the evaluation result more reasonable and objective, but also offer a good foundation for the implementation of the automatic evaluation tool.

AB - Quantitative security risk evaluation of information systems is increasingly drawing more and more attention. This paper extends the attack tree model, and proposes a new quantitative risk evaluation method .While the risk value of the leaf node (atomic attack) is quantified, the multiattribute utility theory is adopted. All algorithms are presented for each steps of this new evaluation method. In addition, a worked example is also experimented in this paper. The experimental result shows that the novel method can not only make the evaluation result more reasonable and objective, but also offer a good foundation for the implementation of the automatic evaluation tool.

UR - http://www.scopus.com/inward/record.url?scp=47349092109&partnerID=8YFLogxK

U2 - 10.1109/FCST.2007.9

DO - 10.1109/FCST.2007.9

M3 - Conference proceeding contribution

AN - SCOPUS:47349092109

SN - 0769530362

SN - 9780769530369

SP - 67

EP - 73

BT - Proceedings - 2007 Japan-China Joint Workshop on Frontier of Computer Science and Technology, FCST 2007

PB - Institute of Electrical and Electronics Engineers (IEEE)

CY - Los Alamitos, Calif

T2 - 2007 Japan-China Joint Workshop on Frontier of Computer Science and Technology, FCST 2007

Y2 - 1 November 2007 through 3 November 2007

ER -

A novel security risk evaluation for information systems

Abstract

Other

Access to Document

Other files and links

Fingerprint

Cite this